A vulnerability in Virgin Media routers left VPN users exposed to attacks that could reveal their IP addresses since at least October 2019. And even though the UK ISP has known about the issue for almost two years, it still hasn’t released a patch.
People often use VPNs to disguise their IP address. This isn’t particularly effective against VPN providers that spy on their users, of course, nor does it offer much protection when law enforcement agencies request access to those providers’ logs. But many people expect that using a VPN will allow them to keep their IP address private while they browse the web. (Wink.)
Fidus Information Security discovered in 2019 that Virgin Media routers were vulnerable to a DNS rebinding attack that can “reveal a user’s actual IP address by simply visiting a web page for a few seconds.” The company said it could “unmask the true IP address of users across multiple popular VPN providers,” but some VPNs did successfully protect this information.
This vulnerability was reportedly disclosed to Virgin Media and its parent company Liberty Global in October 2019. Fidus said that in February 2020 it was asked not to publicly reveal the flaw until the first quarter of 2021, and it agreed not to, but then Virgin Media and Liberty Global both stopped responding to the security company’s requests for more information.
Fidus was set to reveal the vulnerability in March, but after Virgin Media and Liberty Global allegedly ignored those attempts at contact, it held off on the flaw’s public disclosure. It finally decided to reveal the issue in a late September blog post.
The vulnerability in question has been assigned the CVE-2019-16651 identifier. Fidus says that it affects the Virgin Media Super Hub 3 router and that the “underlying model of router (ARRIS TG2492) and related models are a series of DOCSIS fibre routers known to be used by multiple ISPs around the world, many of which are owned by Liberty Global.”
Virgin Media didn’t immediately respond to a request for comment. The company reportedly told The Daily Swig, a blog run by the Portswigger security company, that it’s currently working on some kind of “technical fix” to address the vulnerability.
